## What's Changed * feat(css): add classNameSlug option to createCssContext by @flow-pie in https://github.com/honojs/hono/pull/4834 ## New Contributors * @flow-pie made their first contribution in https://github.com/honojs/hono/pull/4834 **Full Changelog**: https://github.com/honojs/hono/compare/v4.12.10...v4.12.11

## What's Changed * fix(jsx): preserve context when using await before html helper by @kaigritun in https://github.com/honojs/hono/pull/4662 * fix(bearer-auth): make auth-scheme case-insensitive by @bytaesu in https://github.com/honojs/hono/pull/4659 ## New Contributors * @kaigritun made their first contribution in https://github.com/honojs/hono/pull/4662 **Full Changelog**: https://github.com/honojs/hono/compare/v4.11.7...v4.11.8

## What's Changed * fix(client): exclude $all from ClientRequest type by @paveg in https://github.com/honojs/hono/pull/4611 * refactor(jwks): mark allowedAlgorithms, so the user can pass a `const… by @nikeee in https://github.com/honojs/hono/pull/4641 * feat(jwt): export `AlgorithmTypes` by @yusukebe in https://github.com/honojs/hono/pull/4642 ## New Contributors * @paveg made their first contribution in https://github.com/honojs/hono/pull/4611 * @nikeee made their first contribution in https://github.com/honojs/hono/pull/4641 **Full Changelog**: https://github.com/honojs/hono/compare/v4.11.4...v4.11.5

## Security Fixed a JWT algorithm confusion issue in the JWT and JWK/JWKS middleware. Both middlewares now require an explicit algorithm configuration to prevent the verification algorithm from being influenced by untrusted JWT header values. If you are using the JWT or JWK/JWKS middleware, please update to the latest version as soon as possible. ### JWT middleware ```ts import { jwt } from 'hono/jwt' app.use( '/auth/*', jwt({ secret: 'it-is-very-secret', alg: 'HS256', // required }) ) ``` ### JWK/JWKS middleware ```ts import { jwk } from 'hono/jwk' app.use( '/auth/*', jwk({ jwks_uri: 'https://example.com/.well-known/jwks.json', alg: ['RS256'], // required (asymmetric algorithms only) }) ) ``` For more details, see the Security Advisory. * https://github.com/honojs/hono/security/advisories/GHSA-f67f-6cw9-8mq4 * https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4 ## What's Changed * test(utils/jwt): add missing algorithm types in jwa.test.ts by @flathill404 in https://github.com/honojs/hono/pull/4607 * chore: bump `@hono/eslint-config` and enable curly rule by @yusukebe in https://github.com/honojs/hono/pull/4620 * docs(bun/websocket): Fixed a typo in hono/bun deprecation message and updated test. by @Itsnotaka in https://github.com/honojs/hono/pull/4618 * test: support `alg` option for JWT middleware by @yusukebe in https://github.com/honojs/hono/pull/4624 ## New Contributors * @flathill404 made their first contribution in https://github.com/honojs/hono/pull/4607 * @Itsnotaka made their first contribution in https://github.com/honojs/hono/pull/4618 **Full Changelog**: https://github.com/honojs/hono/compare/v4.11.3...v4.11.4

## What's Changed * fix(types): fix app.on method array type inference by @kosei28 in https://github.com/honojs/hono/pull/4578 **Full Changelog**: https://github.com/honojs/hono/compare/v4.11.0...v4.11.1

## What's Changed * chore: bump linter and formatter by @ryuapp in https://github.com/honojs/hono/pull/4568 * chore: bump github actions by @ryuapp in https://github.com/honojs/hono/pull/4569 * fix(linear-router): incorrect path matching by @cromery in https://github.com/honojs/hono/pull/4567 * docs(cookie): update outdated RFC links by @AyushCoder9 in https://github.com/honojs/hono/pull/4557 * feat(csrf): Support async `IsAllowedOriginHandler` by @baseballyama in https://github.com/honojs/hono/pull/4558 * feat(csrf): Support async `IsAllowedSecFetchSiteHandler` by @baseballyama in https://github.com/honojs/hono/pull/4559 ## New Contributors * @cromery made their first contribution in https://github.com/honojs/hono/pull/4567 * @AyushCoder9 made their first contribution in https://github.com/honojs/hono/pull/4557 * @baseballyama made their first contribution in https://github.com/honojs/hono/pull/4558 **Full Changelog**: https://github.com/honojs/hono/compare/v4.10.7...v4.10.8

## Securiy Fix A security issue in the CORS middleware has been fixed. In some cases, a request header could affect the Vary response header. Please update to the latest version if you are using the CORS middleware. ## What's Changed * fix(aws-lambda): serve microsoft office files as binary in lambda handler by @matthiasfeist in https://github.com/honojs/hono/pull/4469 * fix(request-id): validation accepts `=` by @ryuapp in https://github.com/honojs/hono/pull/4478 * refactor(jwt): reduce the size of the code generated by minification by @usualoma in https://github.com/honojs/hono/pull/4480 ## New Contributors * @matthiasfeist made their first contribution in https://github.com/honojs/hono/pull/4469 **Full Changelog**: https://github.com/honojs/hono/compare/v4.10.2...v4.10.3

## Security hardening improvement If you are using JWT middleware, please read the following and consider applying the configuration. ### Improper Authorization in Hono (JWT Audience Validation) Hono’s JWT authentication middleware did not validate the aud (Audience) claim by default. As a result, applications using the middleware without an explicit audience check could accept tokens intended for other audiences, leading to potential cross-service access (token mix-up). The issue is addressed by adding a new `verification.aud` configuration option to allow RFC 7519–compliant audience validation. This change is classified as a security hardening improvement, but the lack of validation can still be considered a vulnerability in deployments that rely on default JWT verification. ### Recommended secure configuration You can enable RFC 7519–compliant audience validation using the new `verification.aud` option: ```ts import { Hono } from 'hono' import { jwt } from 'hono/jwt' const app = new Hono() app.use( '/api/*', jwt({ secret: 'my-secret', verification: { // Require this API to only accept tokens with aud = 'service-a' aud: 'service-a', }, }) ) ``` ## What's Changed * tests: Fix test case of handlers without a path by @IAmSSH in https://github.com/honojs/hono/pull/4472 ## New Contributors * @IAmSSH made their first contribution in https://github.com/honojs/hono/pull/4472 **Full Changelog**: https://github.com/honojs/hono/compare/v4.10.1...v4.10.2